bridge.opendev.org: use Ansible 2.8.0 stable

Testinfra works with Ansible 2.8.0 now, so we can update
bridge.opendev.org to the latest version.  This also needs an ARA
update; bring it to the latest 0.16.4 release.

Update test-requirements so that tox/ansible-lint use Ansible 2.8.0
too.  See note inline about dependencies.

Note we replace import_tasks with include_tasks in handlers to address
this porting issue:
https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_2.8.html#imports-as-handlers

Change-Id: I7ed75d253857f86b68f67023af6897af4e1b4f50

playbooks/bridge.yaml

@@ -12,12 +12,12 @@
     #  install_ansible_version: '{{ bridge_ansible_version | default(None) }}'
     - role: install-ansible
       install_ansible_name: '{{ bridge_ansible_name | default("ansible") }}'
-      install_ansible_version: '{{ bridge_ansible_version | default("2.7.3") }}'
+      install_ansible_version: '{{ bridge_ansible_version | default("2.8.0") }}'
       install_ansible_openstacksdk_name: '{{ bridge_openstacksdk_name | default("openstacksdk") }}'
       install_ansible_openstacksdk_version: '{{ bridge_openstacksdk_verison | default("latest") }}'
       # NOTE(ianw): At 2018-12, ARA is only enabled during gate
       # testing jobs as we decide if or how to store data on
       # production bridge.o.o
       install_ansible_ara_name: '{{ bridge_ara_name | default("ara") }}'
-      install_ansible_ara_version: '{{ bridge_ara_version | default("0.16.1") }}'
+      install_ansible_ara_version: '{{ bridge_ara_version | default("0.16.4") }}'
     - root-keys

playbooks/roles/letsencrypt-create-certs/handlers/main.yaml

@@ -7,32 +7,31 @@
 #
 # listen: letsencrypt updated letsencrypt01-main-service
 #
-# doesn't actually register the handler.  May be a bug or a feature to
-# do with import_tasks; currently unsure.
+# doesn't actually register the handler.
 
 - name: letsencrypt updated graphite01-main
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt-graphite01-main.stamp'
 
 - name: letsencrypt updated mirror01-dfw-rax-main
-  import_tasks: restart_apache.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
 
 # Gate testing hosts:
 - name: letsencrypt updated letsencrypt01-main-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt01-main-service.stamp'
 
 - name: letsencrypt updated letsencrypt01-other-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt01-other-service.stamp'
 
 - name: letsencrypt updated letsencrypt02-main-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt02-main-service.stamp'
 
 - name: letsencrypt updated mirror01-region-provider-opendev-org-main
-  import_tasks: restart_apache.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml

test-requirements.txt

@@ -9,8 +9,13 @@ openstacksdk
 zuul-sphinx>=0.2.3
 testtools
 mock
-# Ansible 2.8 drops the paramiko dep which breaks testinfra
-ansible<2.8.0
 # testinfra 1.17.0 has a broken wheel that won't install under python3
 # testinfra 3.0.0 switched the ansible backend, but broke ipv6 handling
 testinfra!=1.17.0,!=3.0.0
+# testinfra's ansible backend actually requires paramiko, but it's not
+# specified.  After
+#  https://github.com/philpep/testinfra/pull/454
+# releases we can do testinfra[ansible] here instead
+ansible>=2.8.0
+paramiko
+